CVE-2026-72898

VendormetabaseProductmetabaseDiscoveredAug 10, 2026UpdatedAug 12, 2026

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

View graph Watch Export

CVSS v3.1

10 CRITICAL

EPSS

98.8%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 26, 2026 → Nov 1, 2026

▲ 19.6pp

79.2% → 98.8% over 8 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Connections

4 relationships

CWE-89

source

Timeline

disclosure → media coverage

Aug 10, 2026

Disclosure — published as a CVE record.

Aug 11, 2026

acn.gov.it reports: Risolte vulnerabilità in Metabase

Sep 14, 2026

research.checkpoint.com reports: 14th September – Threat Intelligence Report

Public PoC (10)

github.com/0xBlackash/CVE-2026-72898 github.com/codeb0ssx/CVE-2026-72898-PoC github.com/4minx/CVE-2026-72898 github.com/ubitquity/Metabase-Setup-Endpoint-SQLi-Fix github.com/VuxNx/CVE-2026-72898 github.com/Franc-Zar/CVE-2026-72898-safe-detection github.com/d-maggipinto/CVE-2026-72898-metabase-sqli github.com/EQSTLab/CVE-2026-72898 github.com/34zY/CVE-2026-72898 github.com/amier-ge/CVE-2026-72898

Unverified third-party code — review before executing.